0

Please help me to check is email exists or not in while password reset. Magento 2.3.4

$resultRedirect = $this->resultRedirectFactory->create();
    $email = (string)$this->getRequest()->getPost('email'); 
    if ($email) {
        if (!\Zend_Validate::is($email, \Magento\Framework\Validator\EmailAddress::class)) {
            $this->session->setForgottenEmail($email);
            $this->messageManager->addErrorMessage(
                __('The email address is incorrect. Verify the email address and try again.')
            );
            return $resultRedirect->setPath('*/*/forgotpassword');
        }

        try {
            $this->customerAccountManagement->initiatePasswordReset(
                $email,
                AccountManagement::EMAIL_RESET
            );
        } catch (NoSuchEntityException $exception) {
            // Do nothing, we don't want anyone to use this action to determine which email accounts are registered.
        } catch (SecurityViolationException $exception) {
            $this->messageManager->addErrorMessage($exception->getMessage());
            return $resultRedirect->setPath('*/*/forgotpassword');
        } catch (\Exception $exception) {
            $this->messageManager->addExceptionMessage(
                $exception,
                __('We\'re unable to send the password reset email.')
            );
            return $resultRedirect->setPath('*/*/forgotpassword');
        }
        $this->messageManager->addSuccessMessage($this->getSuccessMessage($email));
        return $resultRedirect->setPath('*/*/');
    } else {
        $this->messageManager->addErrorMessage(__('Please enter your email.'));
        return $resultRedirect->setPath('*/*/forgotpassword');
    }

1 Answer 1

1

That would be security risk as any one can check if some user have account on the website or not. Then he just have to guess a password. So, message should be always success.

If you want to change it, you can modify the logic in magento/module-customer/Model/AccountManagement.phpin initiatePasswordReset method where customer is loaded. You can check if customer exists and throw error like,

$this->messageManager->addErrorMessage(__('The email address is does not exist. Verify the email address and try again.')

But I would strongly suggest not to change this logic as that would be security flaw.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.